The main limiting factors are sensor readout speed, JPEG encoder speed and SD write speed.
Sensor readout speed:
- photo mode: timer A = 0x13EB, B = 0xB39 (from an older log from you), 91 microseconds / line (from 0xFFBDF2E8 VSizeSetting), so main FPS clock must be... 56 MHz x 1 channel. Yes, it's not much slower than 500D (32 MHz x 2 channels). Full-res capture at 3.82 FPS.
- LiveView: timer A = 0x9A3 (from your post), B = 0x2F7 (from your log). This gives 29.856 FPS. During initialization, LiveView runs with timer B = 0x405, i.e. at 22 FPS. See this graph:

Raw readout resolution: 1440x572. From this, you will have to trim some black borders. Unfortunately, this 572 smells like 5x3 binning (572*5/3=953). Guess: (AD)TG register [100C] might control this (set to 2 for 3x3 binning; default 4). FFBE168C tg_write.
24p: expecting about 1440x760 (including borders). Maybe 1440x820, if timer A can be reduced to 2298. Maybe even more if HEAD timers are also adjusted (decreased); just a guess.
JPEG encoder speed: measure the execution time of FFBF9F44 / FFBF9DF8 (whichever is used). Place a hook before and after the call, and write down the microsecond timer delta.
SD card speed: trivial to benchmark. Expecting about 20 MB/s. Continuous recording at about 800K per JPG frame.